Electronics and Telecommunications Research Institute

Dong Su Nam

Kiwook Sohn

Hyunggeun Oh

YuJeong Han

Jae Woo Park

Young Tae Yun

Jung Hwan Moon

Yun Ju Kim

An apparatus and method for processing packets are disclosed. The apparatus for processing packets includes a session processing unit, a parallel processing unit, and a storage unit. The session processing unit divides a packet group, including a plurality of HTTP packets, into a plurality of session files, and then distributes the session files. The parallel processing unit generates metadata and extracts content from each of the distributed session files based on the plurality of session files. The storage unit stores the metadata generated by the parallel processing unit and the content extracted by the parallel processing unit.

Apparatus and method for processing packets

A packet analysis apparatus and method and a VPN server, which secure evidence against a situation in which a hacker disguises a packet as a normal packet to make an attack using a VPN server as a router. The packet analysis apparatus includes a packet classification unit for gathering and classifying packets which are used between a host and the VPN server and plaintext packets which are used between the VPN server and a target. A first comparative analysis unit compares contents of an encapsulated IP datagram of each encrypted VPN packet, obtained by decrypting the encrypted VPN packet, with contents of a plaintext IP datagram included in each plaintext packet and present for a target to which the host desires to transfer the encrypted VPN packet. A second comparative analysis unit compares lengths of the encapsulated IP datagram and the plaintext IP datagram with each other.

Packet analysis apparatus and method and virtual private network server

Provided is an apparatus and method for detecting a malicious file that attempts to initiate communication in a mobile terminal without a user's approval. The method of detecting a malicious file in a mobile terminal includes: determining whether a file to be examined is an executable file; when the file is an executable file, examining whether the file is a malicious file that can cause unapproved communication based on at least one predetermined examination condition; and outputting the result of examining whether the file is the malicious file. Accordingly, an attack caused by a new type of malicious code can be coped with.

Apparatus and method for detecting malicious file in mobile terminal

Growing community of inventors

Daejeon, South Korea

Dong Su Nam